Dluca D

Category: Trojan Downloader

Risk: Severe Risk

* Severe threats typically are remotely exploitable vulnerabilities, which can lead to system compromise. Successful exploitation does not normally require any interaction and exploits are in the wild. There exists a high possibility of potential system damage or security flaw. Attacker has complete control over your computer or install new software on your machine.

Description: Dluca Downloader takes a snopshot of the users activity and sends it to a remote FTP server. Dluca Downloader downloads files from a list it retrieves from a web page on 204.177.92.204. It is also able to update itself in this way. At the time of writing, in late November 2003, the other files downloaded were harmless advertising programs.

Alias: None

Signatures:
process: win32info.exe: MD5 Hash: e8be58efb2c65e905dc
process: win32info.exe: MD5 Hash:
process: Dluxjp.exe: MD5 Hash: ..